Input Chunking Vulnerability in Cpanel::JSON::XS Affects RURBAN
CVE-2026-110682

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110682?

The Cpanel::JSON::XS Perl library is vulnerable to an issue where input chunking can alter the decoded value of top-level numbers during parsing. This occurs in versions from 4.42 up to 4.79, where the 'allow_nonref' option is enabled by default. The incremental parser, when influenced by a peer, can misinterpret message streams by changing read boundaries, resulting in improper decoding of values like true, false, or null, which do not have closing delimiters. This vulnerability puts applications using the affected versions at risk of receiving altered data and could lead to significant impacts if exploited.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.